Threat Detection and Vulnerability Management

TRIPLE POINT SECURITY INCORPORATED•Leesburg, VA

2d•$145,000 - $150,000

About The Position

Triple Point Security is seeking a leader for the threat detection and vulnerability management team to support the management, categorization and reporting of system vulnerabilities as well as monitoring potential threats to our federal, state, local, and commercial client engagements. Working within a team of cybersecurity professionals, the Threat Detection and Vulnerability Management Lead will lead a team responsible for vulnerability management, incidence response and threat detection. This role is well-suited for a detail-oriented analyst with hands-on RMF security compliance experience and strong communication and collaboration skills who is looking to grow their career within a specialized, fast-moving cybersecurity consulting firm and mentor junior team members.

Requirements

Bachelor’s degree in Cybersecurity, Information Systems, Information Technology, Computer Science, or a related field, or equivalent combination of education and experience.
7-10 years of experience in information security, cybersecurity compliance, risk management, security assessment, or a related role.
Demonstrated experience reviewing, categorizing and prioritizing vulnerabilities shown in reports from different software. Monitoring threats and handling documentation of incidents.
Working knowledge of the Authorization to Operate (ATO) process and the Risk Management Framework (RMF), including vulnerability remediation standards, implementation, assessment, and remediation tracking.
Strong understanding of NIST SP 800-53, FISMA, and federal information security compliance requirements.
Ability to evaluate security controls and determine whether documentation and implementations adequately address federal compliance expectations.
Experience supporting or participating in vulnerability management and threat detection in federal or federally aligned environments.
Ability to interpret technical, operational, and administrative security controls and communicate gaps, risks, and recommendations to both technical and non-technical stakeholders.
Familiarity with core security concepts such as access control, authentication, logging and monitoring, incident response, configuration management, contingency planning, and vulnerability management.
Strong written and verbal communication skills, including the ability to provide clear compliance feedback, document findings, and support partners through remediation and authorization activities.
Experience collaborating with system owners, ISSOs, security teams, assessors, and external partners to resolve documentation and control deficiencies.
Must be a U.S. citizen eligible to work in a federal environment and, if required, obtain and maintain a federal security clearance.
CompTIA Security+ — Required (or equivalent DoD 8570/8140 baseline certification)

Nice To Haves

Experience supporting federal ATO packages for internal systems, contractor systems, or external partner systems.
Familiarity with reviewing and validating supporting artifacts such as control implementation statements, architecture diagrams, policies, procedures, inventories, contingency plans, incident response documentation, and vulnerability scan results.
Experience helping organizations prepare for or respond to security assessments, independent reviews, or authorization decisions.
Understanding of cloud security and compliance considerations in AWS, Azure, or GCP, including how cloud services affect control inheritance and responsibility models.
Familiarity with Zero Trust Architecture, identity and access management principles, and modern federal cybersecurity initiatives.
Experience with governance, risk, and compliance tools or authorization repositories used to manage SSPs, SARs, POA&Ms, and related artifacts.
Ability to balance compliance requirements with operational realities and provide practical, risk-informed guidance to external partners.
Experience working within or supporting federal agencies, federally funded programs, or regulated environments.
Relevant certifications such as CISSP, CISM, CAP, Security+, CGRC, or similar.
Active Public Trust preferred
CompTIA CySA+, CEH, or GIAC GSEC — Preferred
Cloud security certification (AWS Associate-level or Specialty, AZ-104, or GCP Professional-level) — Preferred
CISSP or CAP — A plus for candidates at the upper end of the experience range

Responsibilities

Prioritize vulnerabilities based on severity, exploitability, asset criticality, exposure, and business impact—not just CVSS scores.
Track remediation efforts and ensure vulnerabilities are addressed within defined SLAs.
Coordinate with infrastructure, application, cloud, DevOps, and security teams to remediate findings.
Analyze security alerts, indicators of compromise, suspicious behavior, and threat intelligence.
Map detections to frameworks such as MITRE ATT&CK and identify gaps in defensive coverage.
Monitor emerging vulnerabilities, exploits, malware, attack campaigns, and threat actors relevant to the organization.
Assess whether newly disclosed vulnerabilities represent an immediate organizational risk.
Translate threat intelligence into actionable detection and vulnerability-management priorities.
Work closely with Security Operations/Incident Response teams when vulnerabilities are actively exploited.
Help investigate potential compromises and determine affected systems.
Coordinate emergency remediation or mitigation for actively exploited vulnerabilities.
Participate in post-incident reviews and use lessons learned to improve detection and prevention.
Communicate technical information effectively to diverse stakeholder groups, including scientific, technical, operational, and leadership audiences, through clear written and verbal communication.
Support the adoption of best practices for confidentiality, integrity, and availability of data across extramural data science activities.